14 lines
414 B
Text
14 lines
414 B
Text
rule Careto_SGH {
|
|
meta:
|
|
author = "AlienVault (Alberto Ortega)"
|
|
description = "TheMask / Careto SGH component signature"
|
|
reference = "www.securelist.com/en/downloads/vlpdfs/unveilingthemask_v1.0.pdf"
|
|
strings:
|
|
$m1 = "PGPsdkDriver" ascii wide fullword
|
|
$m2 = "jpeg1x32" ascii wide fullword
|
|
$m3 = "SkypeIE6Plugin" ascii wide fullword
|
|
$m4 = "CDllUninstall" ascii wide fullword
|
|
condition:
|
|
2 of them
|
|
}
|
|
|